# Stopped at Analyzing Registry **URL:** \ **Category:** Autopsy Help\ **Created:** [October 12, 2020, 4:09pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210 "2020-10-12T16:09:05Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Steve](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/steve/32/1201_2.png) [@Steve](https://sleuthkit.discourse.group/u/Steve)\ **Post date:** [October 12, 2020, 4:09pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/1 "2020-10-12T16:09:06Z")
Good Day, I am a student working on creating a project image for other students to analyze. I am using an HP Pavilion laptop running WIN10 as the target machine. It has a 250gb hard drive with about 220 of that usable to Windows. I backdated the BIOS, installed the OS, did some Edge browsing (the only browser to let you surf with time backdated a year), and then took an image of the drive with dc3dd on to a portable SSD. Took that image and put it on my workstation (Dell Precision 7740, i7-9850H, 32 Gigs of RAM) and ran Autopsy 4.16.0 against it. Started it at 11 pm last night and then when I checked on it 10 hours later, I was stuck at 50% on the Recent Activity ingest module. This is the second time I had run it and got to the same place with 10+ hours. The only thing logged when I canceled the module was \* Failure processing Microsoft Edge WebCacheV01.dat file. ``` Any help would be greatly appreciated. ``` Thanks, Steve ---
**Author:** ![Steve](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/steve/32/1201_2.png) [@Steve](https://sleuthkit.discourse.group/u/Steve)\ **Post date:** [October 13, 2020, 1:53pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/2 "2020-10-13T13:53:33Z")
So took an alternate path to see if I would get another result. I downloaded TSURUGI acquire and booted with that, ran Guymager to do the acquisition, and put them in E01 form this time. The crazy thing is it gets to the exact same spot. I let it run this time from 1 pm to now (almost 17 hours) and its stopped where it reached in roughly 25 min. ![Capture](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/2/22fccdb01e8f9c7ab42036f0755b366bbe31a994.png) ---
**Author:** ![tmctesterson75](https://avatars.discourse-cdn.com/v4/letter/t/9fc348/32.png) [@tmctesterson75](https://sleuthkit.discourse.group/u/tmctesterson75)\ **Post date:** [October 22, 2020, 12:48am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/3 "2020-10-22T00:48:11Z")
I have been having this exact issue, stuck at 50% on the Recent Activity ingest module. Have you been able to resolve the issue? ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [October 22, 2020, 1:14am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/4 "2020-10-22T01:14:26Z")
Can you supply the log file for the case in which you run the recent activity? ---
**Author:** ![Steve](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/steve/32/1201_2.png) [@Steve](https://sleuthkit.discourse.group/u/Steve)\ **Post date:** [October 22, 2020, 1:39am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/5 "2020-10-22T01:39:03Z")
> [@tmctesterson75](#): > > issue, stuck at 50% on the Recent Activity ingest module. Have you been able to resolve the issue? tmc, I was not able to find anything. Because this is an image I am creating for a college course, I just recreated an image on another hard drive. Steve ---
**Author:** ![Steve](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/steve/32/1201_2.png) [@Steve](https://sleuthkit.discourse.group/u/Steve)\ **Post date:** [October 22, 2020, 1:40am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/6 "2020-10-22T01:40:11Z")
Mark, Unfortunately I deleted everything because I was pressed for time for college course. Steve ---
**Author:** ![tmctesterson75](https://avatars.discourse-cdn.com/v4/letter/t/9fc348/32.png) [@tmctesterson75](https://sleuthkit.discourse.group/u/tmctesterson75)\ **Post date:** [October 22, 2020, 1:45am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/7 "2020-10-22T01:45:47Z")
This is the log file from one of my most recent attempts. It always seems to stick at this point ![autopsylog](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/2/2b8897356e27d5fa234048c74a95b0027323e86a.png) ---
**Author:** ![sabebarker](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sabebarker/32/1265_2.png) [@sabebarker](https://sleuthkit.discourse.group/u/sabebarker)\ **Post date:** [November 21, 2020, 6:40am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/8 "2020-11-21T06:40:45Z")
> [@Steve](#): > > Failure processing Microsoft Edge WebCacheV01.dat Having this same issue with ingest module ‘Recent Activity’ freezing at 53%. When cancelled I receive the same error as OP ‘Failure processing Microsoft Edge WebCacheV01.dat’. I have submitted an issue on Github. If anyone is having the exact same come contribute to the issue discussion: [Recent Activity module hangs on Windows 10 · Issue #6483 · sleuthkit/autopsy (github.com)](https://github.com/sleuthkit/autopsy/issues/6483) ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [November 21, 2020, 2:22pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/9 "2020-11-21T14:22:14Z")
There has been a recent fix put in which will go into the next version of Autopsy that does address an infinite loop that is occurring in one of the RegRipper modules that is run as part of the Recent Activity Module in Autopsy. I also was getting this hang so that is how I know about it. If you would like to try and see if this will fix your issue then you can do the following, this should be ok to do on the last few versions of Autopsy. 1. Make sure Autopsy is not running. 2. Download the file [https://github.com/sleuthkit/autopsy/blob/develop/thirdparty/rr-full/plugins/shellactivities.pl](https://github.com/sleuthkit/autopsy/blob/develop/thirdparty/rr-full/plugins/shellactivities.pl) 3. Go to the following directory C:\Program Files\Autopsy-4.xx.0\autopsy\rr-full\plugins and rename the file shellactivities.pl to shellactivities.old. 4. Copy the file from #2 to the directory C:\Program Files\Autopsy-4.xx.0\autopsy\rr-full\plugins. 5. Restart Autopsy and try running the Recent Activity ingest module and see if it goes past 50% The error I was running into was that the registry entry that shellactivities was reading created a infinite loop where it read past the end of the data and kept going. If that does not fix the issue then some more debugging will need to be done. If you have any questions let me know. Mark ---
**Author:** ![sabebarker](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sabebarker/32/1265_2.png) [@sabebarker](https://sleuthkit.discourse.group/u/sabebarker)\ **Post date:** [November 25, 2020, 7:29am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/10 "2020-11-25T07:29:27Z")
Thanks for your response. Unfortunately this did not work for me! ---
**Author:** ![Occas](https://avatars.discourse-cdn.com/v4/letter/o/4491bb/32.png) [@Occas](https://sleuthkit.discourse.group/u/Occas)\ **Post date:** [December 17, 2020, 11:54pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/11 "2020-12-17T23:54:04Z")
Hi Mark, I also gave this a try (I just copied the code from the Github page - I can never find how to download files!) and saved it using notepad and it still stuck on 53%. Is there anything I can check to see if I’m getting the error this should be addressing specifically? ---
**Author:** ![Occas](https://avatars.discourse-cdn.com/v4/letter/o/4491bb/32.png) [@Occas](https://sleuthkit.discourse.group/u/Occas)\ **Post date:** [December 17, 2020, 11:55pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/12 "2020-12-17T23:55:35Z")
Did you just right click Mark’s hyperlink and save as? Because I initially did that and it actually saved the website as the file - once I opened the file, it was a bunch of HTML and something like 15KB whereas the original code is about 6KB ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [December 18, 2020, 1:03am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/13 "2020-12-18T01:03:32Z")
Can you post here or send me a DM with the autopsy.log file when it your hang happens. I should be able to tell you what file is causing the issue. If you could then share that file it will help greatly in figuring out what the issue is. Mark ---
**Author:** ![Occas](https://avatars.discourse-cdn.com/v4/letter/o/4491bb/32.png) [@Occas](https://sleuthkit.discourse.group/u/Occas)\ **Post date:** [December 18, 2020, 2:30am UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/14 "2020-12-18T02:30:35Z")
Hi Mark - here’s the log data. Assuming it’s UsrClass.dat you would want to look at, unfortunately while this is labelled as “Test Laptop” it’s actually one our investigators use and there’s a bunch of confidential names etc in ShellBags that I can’t release. Probably doesn’t help much! > 2020-12-18 09:00:01.802 org.sleuthkit.autopsy.recentactivity.ExtractRegistry analyzeRegistryFiles > INFO: Registry- Now getting registry information from C:\Users\Occas\AppData\Local\Temp\Autopsy\Case\test\_laptop\_20201215\_135736\RecentActivity\reg\UsrClass.dat > 2020-12-18 09:00:01.802 org.sleuthkit.autopsy.recentactivity.ExtractRegistry ripRegistryFile > INFO: Writing Full RegRipper results to: D:\Autopsy Cases\Test laptop\ModuleOutput\RecentActivity\reg\UsrClass.dat-regripper-17949-full.txt > 2020-12-18 09:24:36.879 org.sleuthkit.autopsy.recentactivity.RAImageIngestModule process > INFO: Recent Activity has been canceled, quitting before > 2020-12-18 09:24:36.879 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline process > INFO: Recent Activity analysis of TestLaptop-Liteon.E01 (pipeline=0) finished > 2020-12-18 09:24:36.88 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage > INFO: Finished first stage analysis (data source = TestLaptop-Liteon.E01, objId = 1, pipeline id = 0, ingest job id = 12) > 2020-12-18 09:24:36.88 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage > INFO: Finished analysis (data source = TestLaptop-Liteon.E01, objId = 1, pipeline id = 0, ingest job id = 12) > 2020-12-18 09:24:36.883 org.sleuthkit.autopsy.ingest.IngestManager finishIngestJob > INFO: Ingest job 0 completed ---
**Author:** ![Vincent](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vincent](https://sleuthkit.discourse.group/u/Vincent)\ **Post date:** [January 22, 2026, 2:10pm UTC](https://sleuthkit.discourse.group/t/stopped-at-analyzing-registry/2210/15 "2026-01-22T14:10:35Z")
Same issue with Autopsy 4.22.1. Tested with both Windows 10 and Linux versions, on two different disk images. In my case the Registry Analysis stalls at 18% in an infinite loop. Stracing the java/autopsy processes shows that the processes are doing nothing but WAIT indefinitely.